CVE-2026-108492: WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/quick-paypal-paymentsto a version that resolves this vulnerability.Fixed in 6.0.4
Event History
Frequently Asked Questions
Which installations are affected?
Quick Paypal Payments versions through 6.0.3 are affected. The available data does not identify a lower version boundary.
Can this be exploited remotely without an account?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. Integrity impact is rated low, with no stated confidentiality or availability impact.
Is a default configuration known to be affected?
The provided information does not state whether the vulnerable access-control condition is present in the plugin's default configuration.
What mitigation is available if patching cannot happen immediately?
No specific workaround or compensating control is provided. Restricting exposure of the affected plugin or disabling it may reduce risk, but the supplied data does not document a validated mitigation.